how to zero empty disk space

alenD · 12-21-2007, 09:59 AM

Hi
I want to create an image of my Linux machine.
I understand that I can zero empty disk space to reduce the size of the image. How can I do this?

cat /dev/zero > zero.dat ; sync ; rm -f zero.dat - is this the right command?

thnx

David1357 · 12-21-2007, 01:14 PM

Quote:

Originally Posted by alenD

cat /dev/zero > zero.dat ; sync ; rm -f zero.dat - is this the right command?

That will only zero the space used by the file. It won't zero the information that was used to locate the file (directory entry and so on).

If you really want to zero a drive, I recommend running

Code:

# dd if=/dev/ones of=/dev/hda bs=1M
# dd if=/dev/zero of=/dev/hda bs=1M
# dd if=/dev/ones of=/dev/hda bs=1M
# dd if=/dev/zero of=/dev/hda bs=1M
# dd if=/dev/ones of=/dev/hda bs=1M
# dd if=/dev/zero of=/dev/hda bs=1M

where "/dev/hda" is replaced by the drive you want to zero (e.g. /dev/sda).

The reason for alternating between ones and zeros is that residual data can be read by forensics experts using special software that can peturb the head to the edge of the cylinder. If your kernel does not have "/dev/ones", you can use

Code:

# cat /dev/zero | tr '\000' '\377' | dd of=/dev/hda bs=1M

David1357 · 12-21-2007, 01:17 PM

Quote:

Originally Posted by alenD

I want to create an image of my Linux machine.
I understand that I can zero empty disk space to reduce the size of the image.

If you use Partimage, you won't have to zero the empty space. It parses the file system and skips unused space automatically.

unSpawn · 12-21-2007, 01:20 PM

David1357, when talking Forensics the zeroes and ones scheme is nice but it isn't complete enough.

alenD · 12-21-2007, 02:15 PM

I actually wanted to zero the empty space, NOT the whole hard drive.

alenD · 12-21-2007, 02:16 PM

I dont use Partimage

alenD · 12-21-2007, 02:42 PM

strange... now when I am trying to create an .arc image of my disk the burner keeps creating endless number of 1k files until it fills the disk.
What kind of problem is that?

David1357 · 12-21-2007, 03:14 PM

Quote:

Originally Posted by alenD

I actually wanted to zero the empty space, NOT the whole hard drive.

Yeah, sorry, I misread the post. Why don't you use Partimage? I've been using it for nearly two years with no problems.